[Autogenerated] obviously.
I mean,
we should all acknowledge that username and passwords
like the worst thing we have in the i t.
Now, in many ways, yes.
Which is why now we've got the requirement for multi factor authentication.
Yes, eso that's changed in the standard,
I think was a version three to where it came in A little bit has changed eso
it requires multi factor authentication in two places.
Multi factor authentication for all administrative access.
Yes, or is it privileged access?
It describes it as administrator access,
but that could be fairly broad, because that could be a database administration.
Yes, not merely an operating system administrator.
And then also all remote, all remote access to the cardholder data environment.
Right.
So the way this way this came about at least the way I think it came about Was
that the prior language that used the term two factor authentication said two
factor authentication for all remote network access,
right?
And then, you know, again,
you have to sort of pieces together with some bits in the glossary.
Right?
But the glossary describes remote access,
as you know, from an untrusted network to a trusted network,
right and uh, you know,
again looking at the scoping stuff in the beginning of PC IDE CSS.
All right.
It described out of scope as untrusted.
Right?
So there were a few of us are relatively few of us in the assessor community.
That said, if you're going from out of scope to in scope,
that is remote access and it requires two factor authentication,
right?
So So at least some of us, for many years, held clients, too.
If you're going from your corporate out of scope
environment to your cardholder data environment,
that requires multi factor authentication,
right period paragraph.
When we made them do that on,
then I think a number of assessors didn't for whatever reasons.
And a number of clients had the expectation that if they were
going from their corporate environment to their,
you know, now in scope,
environment that they didn't require multi factor authentication.
They only required it coming from outside of their organizational boundary,
right, which, you know, for many years, I disagreed with.
But then this version of the standard, uh,
described okay, add mons have to always get multi factor,
and then non administrators have to use multi factor authentication
coming from outside the organizational boundary.
Um, so Okay, fine.
Right.
But on the intent really was often described CSS as 280 eights stable
doors that were clothing after the horse has bolted.
That's because because because as new attacks happen,
you know, the brands and the council look at the standard said,
Do we was There's something in the standard.
Do we need to change the standards, put new control in place,
or to make it clearer on there were a lot of breaches where
people were doing administrative access.
Either they got to the fact, honestly,
they got to the people got to the corporate network.
Then they went from the corporate network to the in
scope cardinal the data environment, you know,
by just password guessing and things like that,
and so that the intent was saying no, you know,
someone's got to administrative access.
They have to have multi factor authentication that because
there were just lots and lots of preaches.
I don't know about you, but as an accessory IDE to organizations where,
like anyone could jump into the CD.
It's like that's not secure.
Terrible.
Why would you do that?
You know personally, you know,
my architectural model for this is there is a jump
post or a bastion host in the CBD.
These only device that anyone could ever get to in the C.
D.
Is the jump post or a bastion host.
Then in multi factor authentication to get to that,
then they could go from that to any other device in the seedy.
So you have a choke point with strong access control, right?
Yeah.
Whether it's a bastion host or a VPN endpoint or something like that, Yes.
That's the usual sort of arrangement.
Understand it.
Doesn't I do that?
But if you don't do that, you're asking to be breached, Really?
Right?
Or or you're asking for a much more complex sort of remote access,
absolutely approach, which sounds really terrible.